Vulnerability-Lookup

CVE-2026-73499 (GCVE-0-2026-73499)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:20 – Updated: 2026-08-14 22:19

Title

etcd: Watch API authorization bypass via open-ended range requests

Summary

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 22:19 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

8 references

URL	Tags
https://github.com/etcd-io/etcd/security/advisori…	x_refsource_CONFIRM
https://github.com/etcd-io/etcd/commit/6643f80602…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/7cf71ec9e2…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/afeaa624da…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/e863b001bb…	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.5.33	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.6.14	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.7.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
etcd-io	etcd	Affected: < 3.5.33 Affected: >= 3.6.0, < 3.6.14 Affected: >= 3.7.0-alpha.0, < 3.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T22:19:48.980697Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T22:19:59.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "etcd",
          "vendor": "etcd-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.5.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.6.0, \u003c 3.6.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-alpha.0, \u003c 3.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:20:31.888Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xg4h-6gfc-h4m8",
        "discovery": "UNKNOWN"
      },
      "title": "etcd: Watch API authorization bypass via open-ended range requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73499",
    "datePublished": "2026-08-12T21:20:31.888Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-14T22:19:59.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73499",
      "date": "2026-08-16",
      "epss": "0.00365",
      "percentile": "0.29671"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73499\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-12T22:17:17.130\",\"lastModified\":\"2026-08-14T23:16:33.477\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"etcd-io\",\"product\":\"etcd\",\"versions\":[{\"version\":\"\u003c 3.5.33\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.6.0, \u003c 3.6.14\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.7.0-alpha.0, \u003c 3.7.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-14T22:19:48.980697Z\",\"id\":\"CVE-2026-73499\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/releases/tag/v3.5.33\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/releases/tag/v3.6.14\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/releases/tag/v3.7.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-14T22:19:48.980697Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-14T22:19:54.407Z\"}}], \"cna\": {\"title\": \"etcd: Watch API authorization bypass via open-ended range requests\", \"source\": {\"advisory\": \"GHSA-xg4h-6gfc-h4m8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"etcd-io\", \"product\": \"etcd\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.5.33\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.6.0, \u003c 3.6.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.7.0-alpha.0, \u003c 3.7.1\"}]}], \"references\": [{\"url\": \"https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8\", \"name\": \"https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41\", \"name\": \"https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed\", \"name\": \"https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae\", \"name\": \"https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7\", \"name\": \"https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/releases/tag/v3.5.33\", \"name\": \"https://github.com/etcd-io/etcd/releases/tag/v3.5.33\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/releases/tag/v3.6.14\", \"name\": \"https://github.com/etcd-io/etcd/releases/tag/v3.6.14\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/etcd-io/etcd/releases/tag/v3.7.1\", \"name\": \"https://github.com/etcd-io/etcd/releases/tag/v3.7.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-12T21:20:31.888Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-14T22:19:59.624Z\", \"dateReserved\": \"2026-08-12T19:00:33.736Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-12T21:20:31.888Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73499

Vulnerability from fkie_nvd - Published: 2026-08-12 22:17 - Updated: 2026-08-14 23:16

Severity

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
	security-advisories@github.com	https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed
	security-advisories@github.com	https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
	security-advisories@github.com	https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
	security-advisories@github.com	https://github.com/etcd-io/etcd/releases/tag/v3.5.33
	security-advisories@github.com	https://github.com/etcd-io/etcd/releases/tag/v3.6.14
	security-advisories@github.com	https://github.com/etcd-io/etcd/releases/tag/v3.7.1
	security-advisories@github.com	https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "etcd",
          "vendor": "etcd-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.5.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.6.0, \u003c 3.6.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-alpha.0, \u003c 3.7.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."
    }
  ],
  "id": "CVE-2026-73499",
  "lastModified": "2026-08-14T23:16:33.477",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73499",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T22:19:48.980697Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T22:17:17.130",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XG4H-6GFC-H4M8

Vulnerability from github – Published: 2026-07-24 22:38 – Updated: 2026-08-12 21:20

Summary

etcd: Watch API authorization bypass via open-ended range requests

Details

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

etcd 3.7.1
etcd 3.6.14
etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

Luis Toro (@lobuhi on Github)
Anthropic and Adam Korczynski (@AdamKorcz on Github)

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0-alpha.0"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "3.6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:38:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, \"from this key to the end of the keyspace\" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key \u2014 not just the one key they were granted. \n\nThis is an authorization bypass in etcd\u0027s RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled \u2014 clusters running without auth already allow unrestricted read access.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis vulnerability is patched in the following versions:\n\n- etcd 3.7.1\n- etcd 3.6.14\n- etcd 3.5.33\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading is not immediately possible, the following mitigations reduce exposure:\n\n- Audit READ grants. Any READ grant \u2014 even on one key \u2014 can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn\u0027t trust with full read access.\n- Restrict network access. Limit which hosts can reach etcd\u0027s client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.\n\n### Reporter\n\n- Luis Toro ([@lobuhi](https://github.com/lobuhi) on Github)\n- Anthropic  and Adam Korczynski ([@AdamKorcz](https://github.com/AdamKorcz) on Github)",
  "id": "GHSA-xg4h-6gfc-h4m8",
  "modified": "2026-08-12T21:20:37Z",
  "published": "2026-07-24T22:38:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/etcd-io/etcd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "etcd: Watch API authorization bypass via open-ended range requests"
}

ubuntu-cve-2026-73499

Vulnerability from osv_ubuntu

Published

2026-08-13 00:00

Modified

2026-08-13 00:00

Summary

Details

Severity

7.1 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-73499	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-73499	REPORT
	https://github.com/etcd-io/etcd/security/advisori…	REPORT
	https://github.com/etcd-io/etcd/commit/6643f80602…	REPORT
	https://github.com/etcd-io/etcd/commit/7cf71ec9e2…	REPORT
	https://github.com/etcd-io/etcd/commit/afeaa624da…	REPORT
	https://github.com/etcd-io/etcd/commit/e863b001bb…	REPORT
	https://github.com/etcd-io/etcd/releases/tag/v3.5.33	REPORT
	https://github.com/etcd-io/etcd/releases/tag/v3.6.14	REPORT
	https://github.com/etcd-io/etcd/releases/tag/v3.7.1	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd",
            "binary_version": "2.2.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "2.2.5+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@2.2.5+dfsg-1ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.0+dfsg-2",
        "2.2.1+dfsg-1",
        "2.2.2+dfsg-1",
        "2.2.2+dfsg-2",
        "2.2.3+dfsg-1",
        "2.2.5+dfsg-1",
        "2.2.5+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd",
            "binary_version": "3.2.17+dfsg-1ubuntu0.1+esm2"
          },
          {
            "binary_name": "etcd-client",
            "binary_version": "3.2.17+dfsg-1ubuntu0.1+esm2"
          },
          {
            "binary_name": "etcd-server",
            "binary_version": "3.2.17+dfsg-1ubuntu0.1+esm2"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "3.2.17+dfsg-1ubuntu0.1+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@3.2.17+dfsg-1ubuntu0.1+esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.0-1",
        "3.2.9+dfsg-2",
        "3.2.9+dfsg-3",
        "3.2.17+dfsg-1",
        "3.2.17+dfsg-1ubuntu0.1~esm1",
        "3.2.17+dfsg-1ubuntu0.1",
        "3.2.17+dfsg-1ubuntu0.1+esm1",
        "3.2.17+dfsg-1ubuntu0.1+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd",
            "binary_version": "3.2.26+dfsg-6ubuntu0.2+esm1"
          },
          {
            "binary_name": "etcd-client",
            "binary_version": "3.2.26+dfsg-6ubuntu0.2+esm1"
          },
          {
            "binary_name": "etcd-server",
            "binary_version": "3.2.26+dfsg-6ubuntu0.2+esm1"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "3.2.26+dfsg-6ubuntu0.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@3.2.26+dfsg-6ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.26+dfsg-3",
        "3.2.26+dfsg-4",
        "3.2.26+dfsg-6",
        "3.2.26+dfsg-6ubuntu0.1",
        "3.2.26+dfsg-6ubuntu0.2",
        "3.2.26+dfsg-6ubuntu0.2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd",
            "binary_version": "3.3.25+dfsg-7ubuntu0.22.04.2+esm3"
          },
          {
            "binary_name": "etcd-client",
            "binary_version": "3.3.25+dfsg-7ubuntu0.22.04.2+esm3"
          },
          {
            "binary_name": "etcd-server",
            "binary_version": "3.3.25+dfsg-7ubuntu0.22.04.2+esm3"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "3.3.25+dfsg-7ubuntu0.22.04.2+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@3.3.25+dfsg-7ubuntu0.22.04.2+esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.25+dfsg-6",
        "3.3.25+dfsg-7",
        "3.3.25+dfsg-7ubuntu0.22.04.1",
        "3.3.25+dfsg-7ubuntu0.22.04.1+esm1",
        "3.3.25+dfsg-7ubuntu0.22.04.2",
        "3.3.25+dfsg-7ubuntu0.22.04.2+esm1",
        "3.3.25+dfsg-7ubuntu0.22.04.2+esm2",
        "3.3.25+dfsg-7ubuntu0.22.04.2+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd-client",
            "binary_version": "3.4.30-1ubuntu0.24.04.3+esm2"
          },
          {
            "binary_name": "etcd-server",
            "binary_version": "3.4.30-1ubuntu0.24.04.3+esm2"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "3.4.30-1ubuntu0.24.04.3+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@3.4.30-1ubuntu0.24.04.3+esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.23-4ubuntu2",
        "3.4.30-1",
        "3.4.30-1build1",
        "3.4.30-1ubuntu0.24.04.1",
        "3.4.30-1ubuntu0.24.04.2",
        "3.4.30-1ubuntu0.24.04.2+esm1",
        "3.4.30-1ubuntu0.24.04.3",
        "3.4.30-1ubuntu0.24.04.3+esm1",
        "3.4.30-1ubuntu0.24.04.3+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "etcd-client",
            "binary_version": "3.5.16-10ubuntu0.26.04.1~esm1"
          },
          {
            "binary_name": "etcd-server",
            "binary_version": "3.5.16-10ubuntu0.26.04.1~esm1"
          },
          {
            "binary_name": "golang-etcd-server-dev",
            "binary_version": "3.5.16-10ubuntu0.26.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "etcd",
        "purl": "pkg:deb/ubuntu/etcd@3.5.16-10ubuntu0.26.04.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.16-4",
        "3.5.16-10",
        "3.5.16-10ubuntu0.26.04.1~esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.",
  "id": "UBUNTU-CVE-2026-73499",
  "modified": "2026-08-13T00:00:00Z",
  "published": "2026-08-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-73499"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73499"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-73499"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73499 (GCVE-0-2026-73499)

FKIE_CVE-2026-73499

GHSA-XG4H-6GFC-H4M8

Impact

Patches

Workarounds

Reporter

ubuntu-cve-2026-73499

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature